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The realization of devices which harness the 
laws of quantum mechanics represents an excit- 
ing challenge at the interface of modern tech- 
nology and fundamental science [1, 2]. An ex- 
emplary paragon of the power of such quantum 
primitives is the concept of "quantum money" 
[3]. A dishonest holder of a quantum bank-note 
will invariably fail in any forging attempts; in- 
deed, under assumptions of ideal measurements 
and decoherence-free memories such security is 
guaranteed by the no-cloning theorem [4]. In any 
practical situation, however, noise, decoherence 
and operational imperfections abound. Thus, the 
development of secure "quantum money" -type 
primitives capable of tolerating realistic infideli- 
ties is of both practical and fundamental impor- 
tance. Here, we propose a novel class of such pro- 
tocols and demonstrate their tolerance to noise; 
moreover, we prove their rigorous security by 
determining tight fidelity thresholds. Our pro- 
posed protocols require only the ability to pre- 
pare, store and measure single qubit quantum 
memories, making their experimental realization 
accessible with current technologies [5—7]. 

Recent extensions to Wiesner's original "quantum 
money" protocol [3] have garnered significant interest [8- 
11]. One particular extension enables the authentication 
of quantum tokens via classical public communication 
with a trusted verifier [12]. However, to tolerate noise, 
the verification process must condone a certain finite frac- 
tion of qubit failures; naturally, such a relaxation of the 
verification process enhances the ability for a dishonest 
user to forge quantum tokens. It is exactly this interplay 
which we, here, seek to address, by focusing on a class 
of "quantum token" -protocols which involve either direct 
physical or classical communication verification of qubit 
memories. 

Our approach to quantum tokens extends the origi- 
nal quantum money primitive [3] by ensuring tolerance to 
finite errors associated with encoding, storage and decod- 
ing of individual qubits. We denote the tokens within our 
first primitive as quantum tickets (qtickets) ; each qticket 
is issued by the mint and consists of a unique serial 
number and component quantum states, p = ®^pi^ 
where each pi is drawn uniformly at random from the 
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set, Q = {|+), |-), I + i), I - i), |0), |1)}, of polarization 
eigenstates of the Pauli spin operators. The mint secretly 
stores a classical description of p, distributed only among 
trusted verifiers. In order to redeem a qticket, the holder 
physically deposits it with a trusted verifier, who mea- 
sures the qubits in the relevant basis. This verifier then 
requires a minimum fraction, Ftoi, of correct outcomes 
in order to authenticate the qticket; following validation, 
the only information returned by the verifier is whether 
the qticket has been accepted or rejected. 

The soundness of a qticket, e.g. the probability that 
an honest user is successfully verified, depends crucially 
on the experimental fidelities associated with single qubit 
encoding, storage and decoding. Thus, for a given qubit 
Pi, we define the map, Mj, which characterizes the over- 
all fidelity, beginning with the mint's encoding and end- 
ing with the verifier's validation; the average channel 
fidelity[13] is then given by, Fi = 1/\Q\ TT[piMi{pi)]. 
With this definition, the verification probability of an 
honest user is. 



where Q = Q*^ , Pace represents the projector onto 
the subspace of valid qtickets, M = (^^M^, Fexp = 
'^/N^.Fi is the average experimental fidelity, and D, 
the relative entropy, characterizes the distinguishability 
of two distributions (see Methods for details). Crucially, 
so long as the average experimental fidelity associated 
with single qubit processes is greater than the tolerance 
fidelity, an honest user is exponentially likely to be veri- 
fied. 

To determine a tight security threshold, we consider 
the counterfeiting of a single qticket. For a given toler- 
ance fidelity (Ftoi) set by the verifiers, a qticket is only 
accepted if at least Ftoi^ qubits are validated. In the 
event that a dishonest user attempts to generate two 
qtickets from a single valid original, each must contain a 
minimum of FtoiN valid qubits to be authenticated. As 
depicted in Fig. la., in order for each counterfeit qticket 
to contain Fto\N valid qubits, a minimum of (2Ftoi — 1)^^ 
qubits must have been perfectly cloned. Thus, for a set 
tolerance fidelity, in order for a dishonest user to succeed, 
he or she must be able to emulate a qubit cloning fidelity 
of at least 2Ftoi — 1- Crucially, so long as this fidelity 
is above that achievable for optimal qubit cloning (2/3) 
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FIG. 1: a) Depicts the pigeonhole type argument which is 
utiUzed in the proof of qticket soundness. For a tolerance 
fidelity Ftoi, a qticket is only successfully authenticated if it 
contains at least Fto\N valid qubits. However, for two coun- 
terfeit qtickets, not all valid qubits must coincide. The mini- 
mum number of perfectly cloned qubits enabling both qtick- 
ets to be accepted is, (2Ftoi — . b) Depicts the quantum 
retrieval type situation envisioned for cv-qtickets. For two 
verifiers asking complementary "challenge" questions, the op- 
timal strategy is for the user to measure in an intermedi- 
ate basis. Such a strategy saturates the tolerance threshold, 

T-.CV _ I + I/V2 



[14], a dishonest user is exponentially unlikely to succeed, 

where T represents any completely positive trace preserv- 
ing qticket counterfeiting map. To ensure 2Ftoi — 1 > 2/3, 
the tolerance fidelity must be greater than 5/6, which is 
precisely the average fidelity of copies produced by an 
optimal qubit cloning map [14]. In certain cases, an 
adversary may be able to sequentially engage in multi- 
ple verification rounds; however, the probability of suc- 
cessfully validating counterfeited qtickets grows at most 
quadratically in the number of such rounds, and hence, 
the likelihood of successful counterfeiting can remain ex- 
ponentially small even for polynomially large numbers of 
verifications. 

Our previous discussion of qtickets assumed that such 
tokens are physically transferable to trusted verifiers (e.g. 
concert tickets); however, in many situations, this as- 



sumption of physical deposition, may either be impos- 
sible or undesirable. Recently, it has been shown [12] 
that it remains possible, even remotely, for a holder to 
prove the validity of a token by responding to a set of 
"challenge" questions; these questions can only be suc- 
cessfully answered by measuring an authentic token. The 
core behind this approach is to ensure that the "chal- 
lenge" questions reveal no additional information about 
the quantum state of the token. 

We now discuss a specific realization of such an ap- 
proach, the classical verification quantum ticket (cv- 
qticket), and demonstrate its robustness against noise 
and operational imperfections. In contrast to the case of 
bare qtickets, a cv-qticket holder will be expected to an- 
swer "challenge" questions and hence to measure qubits 
himself. One might imagine that the ability to par- 
ticipate in multiple remote verifications simultaneously 
could offer a dishonest user an additional advantage over 
the bare qticket case; in particular, certain measurement 
strategies may yield an increased likelihood for multiple 
successful authentications. 

One example of a cv-qticket framework, is to utilize a 
set of eight possible two-qubit product states with each 
qubit prepared along either X 01 Z (note that a single 
qubit framework is also possible): 

{|0,+),|0,-),|1,+),|1,-),|+,0),|-,0),|+,1),|-,1)}. 

We then envision each cv-qticket to consist of n blocks, 
each containing r qubit pairs, and thus, a total of n x r x 2 
qubits; as before, each of the qubit pairs is chosen uni- 
formly at random from the allowed set above. A "chal- 
lenge" question consists of randomly asking the holder to 
measure each block (of qubits) along either the X or Z 
basis; naturally, as depicted in Table 1, a valid qubit pair 
(within a block) is one in which the holder correctly an- 
swers the state for the particular qubit (within the pair) 
which was prepared along the questioned basis. For a 
given tolerance threshold, an overall answer will only be 
deemed correct if at least F^^^r qubits within each of the 
n blocks are found valid. By analogy to the qticket case, 
honest users are exponentially likely to be verified so long 
as Fexp > in particular, since there now exist n 

blocks of qubits, each of which can be thought of as an 
individual qticket (with r qubits). 



-rD(F,,p||FS) 



(3) 



The proof of cv-qticket security is based upon a gen- 
eralized formalism of quantum retrieval games [12, 15], 
in combination with a generalized Chernoff-Hoeffding 
bound [16] (details in Supplementary Information). So 

long as F^^^ > "^^^^ ^ ^ dishonest user is exponentially 
unlikely to be authenticated by two independent verifiers. 
For two complementary "challenge" questions, one finds 
that on average, no more than 1 + 1/a/2 ^ 1.707 can be 
answered correctly. Interestingly, the threshold F^^JJ cor- 
responds exactly to that achievable by either covariant 
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TABLE I: Verification of a single cv-qticket. Here, we con- 
sider a cv-qticket with n — \ and r = 2, totaling 8 qubit 
pairs and Ftoi = 3/4 (for illustrative purposes only). The 
prepared qubit-pairs are chosen at random, as are the bank's 
requested measurement bases (for each block). The holder's 
answer has at most, a single error per block, which accord- 
ing to, Ftoi = 3/4, is allowed. Secure cv-qtickets require 
Fto\ > 1/2 + 1/a/8 and a larger number of constituent qubits. 



qubit cloning [17] or by measurement in an intermediate 
basis (Fig. lb.), suggesting that both such strategies may 
be optimal [2]. Similar to the qticket case, one finds that 
a dishonest user is exponentially likely to fail. 
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where v represents the number of repeated verification 
attempts (for details see Supplementary Information). 
Moreover, so long as two verifiers agree to ask comple- 
mentary "challenge" questions, participation in simulta- 
neous verifications is unable to improve a dishonest user's 
emulated fidelity. Thus, in the case of both qtickets and 
cv-qtickets, so long as the hierarchy of fidelities is such 
that: ^dishonest < ^toi < ^exp, it is possiblc to prove both 
soundness and security of each protocol. 

Next, we consider applications of the above primitives 
to practically relevant protocols. For instance, one might 
imagine a composite cv-qticket which allows for multi- 
ple verification rounds while also ensuring that the to- 
ken cannot be split into two independently valid sub- 
parts [12]. Such a construction may be used to create 
a quantum-protected credit card. Indeed, the classical 
communication which takes place with the issuer (bank) 
to verify the cv-qticket (via "challenge" questions) may 
be intentionally publicized to a merchant who needs to be 
convinced of the card's validity. By contrast to modern 
credit card implementations, such a quantum credit card 
would be unforgeable and hence immune to fraudulent 
charges (Fig. 2a). 

An alternate advantage offered by the qticket frame- 
work is evinced in the case where verifiers may not pos- 
sess a secure communication channel with each other. 
Consider for example, a dishonest user who seeks to copy 
multiple concert tickets, enabling his friends to enter at 
different checkpoint gates. A classical solution would in- 
volve gate verifiers communicating amongst one another 
to ensure that each ticket serial number is only allowed 
entry a single time; however, as shown in Fig. 2b., such 
a safeguard can be overcome in the event that commu- 
nication has been severed. By contrast, a concert ticket 



QBank 

Ca^d Copy 




store 1 Store 


Store! 








FIG. 2: a) Depicts the possibility of using the cv-qticket 
framework to implement a quantum-protected credit card. 
Unlike its classical counterpart, the quantum credit card 
would naturally be unforgeable; this prevents thieves from be- 
ing able to simply copy credit card information and perform 
remote purchases, b) Depicts a dishonest user who attempts 
to copy a concert qticket (e.g. same serial number), enabling 
his friend to enter at an alternate checkpoint gate. Naively, 
each verifier can communicate with one another to prevent 
such abusive ticket cloning. However, such a safeguard can 
be overcome in the event that the communication among ver- 
ifiers is either unsecured, unavailable or severed (possibly by 
the dishonest user himself). The qticket is exempt from this 
type of attack since security is guaranteed even in the case of 
isolated verifiers. 



based upon the proposed qticket primitive would be au- 
tomatically secure against such a scenario; indeed, the 
security of qtickets is guaranteed even when verifiers are 
assumed to be isolated. Such isolation may be especially 
useful for applications involving quantum identification 
tokens, where multiple verifiers may exist who are either 
unable or unwilling to communicate with one another. 

While quantum primitives have been the subject of 
tremendous theoretical interest, their practical realiza- 
tion demands robustness in the face of realistic imperfec- 
tions. Our above analysis demonstrates that such noise 
tolerance can be achieved for certain classes of unforge- 
able quantum tokens. Moreover, the derived tolerance 
thresholds are remarkably mild and suggest that proof of 
principle experiments are currently accessible in systems 
ranging from trapped ions [5, 18] and superconducting 
devices [6, 19] to solid-state spins [7, 20-22]. In partic- 
ular, recent advances on single nuclear spins situated in 
a compact room-temperature solid, have demonstrated 
that ultra-long storage times can be attained in combi- 
nation with high fidelity initialization and readout [7]; 
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such advances suggest that quantum devices based upon 
single qubit quantum memories may be both practical 
and realistically feasible. 

While our analysis has focused on describing a primi- 
tive based upon single tokens, natural extensions to the 
case of multiple identical quantum tokens open up the 
possibility of even more novel applications. In particu- 
lar, as detailed in the Supplementary Information, it is 
possible to extend our threshold results to the case where 
c identical copies of the quantum token are issued. In this 
case, to ensure that the production of c + 1 valid tokens is 
exponentially improbable, the required threshold fidelity 

r . The existence of such 



must be greater than 1 — (^^_^^^(^^_^2) • 
multiple identical tokens can provide a certain degree of 
anonymity for users and could be employed in primi- 
tives such as quantum voting. A crucial question that 
remains is whether a rigorous proof of anonymity can be 
obtained in a noisy environment. Furthermore, our pro- 
posed quantum tokens can also be seen as a basic noise 
tolerant building block for implementing more advanced 
application schemes; such schemes can range from novel 
implementations of quantum key distribution [2, 23-25] 
based upon physical qubit transport to complex one- 
time-entry identification cards. Beyond these specific 
applications, a number of scientific avenues can be ex- 
plored, including for example, understanding whether an 
interplay between computational assumptions and quan- 
tum memories can yield fundamentally new approaches 
to encryption. 



Methods 

Proof of Quantum Ticket Soundness — To 

demonstrate the soundness and security of qtickets, we 
employ the framework of a Chernoff Bound, which char- 
acterizes the central limiting behavior of a set of indepen- 
dent random variables; in particular, it provides expo- 
nentially decreasing bounds on tail distributions of their 
sums. Here, we state a generalization of this bound [16], 



Theorem: Generalized Chernoff- Hoeffding bound 

Let Xi, . . . , Xn be Boolean {0, 1} random variables, such 
that for some 5i and every S C {1, . . . , nj^ it holds that 
Pr[Aies^i] <UiesSi- Then 

n 

Pr[^X, >7n] <e- 



■nD(^\\5) 



with S := n ^ ^i=i /^^ ^^V 7 ^ ^ 7 ^ 1- 

D{p\\q) = pin I + (1 — p)lnY5f characterizes the dis- 
tinguishability of two binary probability distributions, 
where Pr(X = 1) = p for the first distribution and 
Pr(X = 1) = g for the second. To establish the soundness 
of qtickets, we now define the "acceptor", P^cc which 
projects a pure N qubit product state onto the subspace 



of valid qtickets. As expected, the size of this subspace 
will depend on the verifiers tolerance fidelity, Ftoi- 

Definition: Acceptance Projector 

Given p = Pi ^ security parameter < Ftoi < 

1, the acceptance projector is given by 



pp 

^ acc 



N 



{hi Pi -h hi pi) . 



h G {0,1}^ is a length boolean string with \h\i = 
Eili hi, hi = I - hi, and p^ = 1 - pi. Intuitively, \b\i 
can be thought of as a Hamming weight since it charac- 
terizes the number of non-zero entries of the string. The 
sum is over all strings which have at least Fto\N entries 
which are 1; thus, the definition of h naturally enforces 
the projection onto the set of valid qticket states. We now 
recall the qubit map Mi which characterizes the overall 
fidelity, F^, of encoding, storage and decoding. We de- 
fine Fexp = ^/N^^Fi to be the average achievable ex- 
perimental fidelity. This brings us to the statement of 
qticket soundness. 

Theorem: Soundness of a Quantum Ticket 

For Fexp > i^tob honest holder successfully redeem a 
qticket with probability 

Proof. Consider a vector composed of boolean random 
variables, X = (Xi, . . . ,Xiv), with a joint probability 
distribution given by 



peg 



N 



M{p)l^{hiPi^hipi) 



^ 1 

= 11^ 5]Tr[M,(p,)(M, + M,^)] 



As evidenced, we can consider Xi to be independent 
boolean random variables with probability Pr[A^] = Fi. 
Moreover, a simple calculation reveals that Eq. 1 of the 
main text can be recast as, XlpGQ ^"^[-^icc^ip)] ~ 
PrE^^i^i > ^toiA^]- Application of the Chernoff 



bound yields the desired result. ■ 

The security proof for qtickets, detailed in the supple- 
mentary information, follows in a similar fashion; it re- 
quires the generalized Chernoff-Hoeffding bound to rig- 
orously deal with arbitrary counterfeiting attacks, which 
may in principle generate correlations between qticket 
components. 
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S.l. NOTATION AND EXTERNAL RESULTS 

The following definitions and external results will be used 
extensively throughout the proofs and are included here to 
provide a self-contained presentation. 

Definition 1 A quantum state t-design is a probability distri- 
bution over pure quantum states {pi^\ ipi)) such that 

^ J Haar 

In Other words, a quantum state t-design duplicates the proper- 
ties of the unique unitarily invariant Haar measure over quan- 
tum states for all polynomials up to degree t. We will use the 
set of states 

= {|o),|i),|+),|-),|+i),|-i)} (SI) 

with equal weights pi = 1/6; this constitutes a quantum state 
3-design over I-L2 [SI]- 

The average fidelity for a channel quantifies how well the 
channel preserves quantum states. 

Definition 2 The Average fidelity of a map M is defined as 
F{M)= [ (t/.|M(| I 

^Haar 

Note for example that the average fidelity of a map M is ex- 
pressed as a Haar integral of a degree 2 polynomial expression 
in bras and kets and can thus be equated to a weighted average 
over a quantum state 2-design. 

Throughout the text, boolean values B = {True^ False] 
will be represented as True := 1, False := and the nega- 
tion h := 1 — h. We will also use the variable h to denote 
boolean strings (i.e. ordered sequences of values in {0, 1}) 
with len(6) denoting the length or number of components of 
a sequence and t\(h) denoting the string obtained from re- 
moving the last element from h. We will denote by Pr[e] 
the probaility of an event e and Exp[v] the expectation value 
of an expression v. Note that according to our convention, if 
the expression is a boolean formula they may be used inter- 
changeably. 

The relative entropy is a distinguishability measure be- 
tween two probability distributions. It will be used extensively 
(particularly among binary or Bernoulli distributions) and ap- 
pears in the definition of auxiliary results. Let < g < 1, 
by abuse of notation, we take D{p\\q) = pln| + (1 — 



p) In j5f . the relative entropy between two Bernoulli prob- 
ability distributions with respective parameters p and q. Note 
that this definition satisfies D{p\\q) > 2(p — g)^. 

The following generalization of the Chemoff-Hoeffding 
bound derived by Panconesi and Srinivasan [S2] provides the 
same thesis as a standard Chemoff bound while relaxing the 
hypothesis to allow dependent random variables. 

Theorem 3 ( Generalized Chernoff-Hoeffding bound) Let 
Xi, . . . , Xn be Boolean {0, 1} random variables, such that 
for some 6i and every S C {!,..., n}, it holds that 
Pr [^iesXi] <UiesSi- Then 

n 

Pr[^Xi >7n] < e-^^^^ll^) 
i=i 

with 5 := Y^^=i <^ndfor any 'j sJ. S < ^ < 1. 

A further generalization to real valued random variables 
will also be required. This is adapted to our purpose from 
theorem 3.3 of Impagliazzo and Kabanets [S3]. 

Theorem 4 Let Xi , . . . , Xn be real valued random variables, 
with each Xi G [0, 1]. Suppose that there is a < S < 1 
s.t., for every set S C {1, . . . , n}, Exp [H^^s ^ 
and ^ s.t. 5 < ^ < 1 and G N. Then we have that 



S.2. QTICKETS 

We first provide a rigorous definition of qtickets and how 
they are verified. We then proceed to our claims, and the 
soundness, security and tightness of our security bound (ac- 
companied with respective proofs). Namely, we show that 
qtickets may be successfully redeemed by an honest holder 
achieving a sufficiently good storage fidelity. We then show 
that a dishonest holder will have a negligible chance of pro- 
ducing two qtickets which are accepted by verifiers from a 
single valid qticket, even after repeated verification attempts. 
Finally we show how a simple counterfeiting strategy has a 
high probability of producing two such qtickets if the verifi- 
cation tolerance is set below the threshold value. As an ex- 
tension, we consider how our results generalize to producing 
multiple identical qtickets. 



2 



S.2.1. Definition of qtickets 



Each qticket consists of a serial number s and an N com- 



ponent pure product state p^^^ = p\^^ . For each serial 

(s) 

number s, qticket components ^ are chosen uniformly at 
random from Q. This means qtickets p^^^ are taken uniformly 
at random from the set Q = Q^^ (where by abuse of nota- 
tion, the elements of Q are component pure product states 
in Hq = 7^2^, with components taken from Q). The verifiers 
store a database containing, for each s, a classical description 
of p^^^ kept secret from ticket holders and the general public. 
In order to simplify notation, the serial number s associated to 
individual qtickets will be omitted from now on. 

In order to use qtickets, they are transferred to a verifica- 
tion authority who can either accept or reject them. In both 
cases however, the qticket is not returned, only the binary 
outcome of verification. The qticket protocol is additionally 
parametrized by the fraction Ftoi of qubits that a verification 
authority requires to be correct in order for verification to suc- 
ceed. In order to verify a submitted qticket p, sl full measure- 
ment will be performed in the product basis associated to the 
original qticket p and the number of correct outcomes is then 
counted. If more than at least Fto\N are correct, the (pos- 
sibly noisy) submitted qticket p is accepted, otherwise, it is 
rejected. 

For any pure product state p = ^i^i Pi we define a pro- 
jector Pf^^ G jC{Hq) associated to the subspace of states that 
would be accepted if p were a qticket (i.e. states coinciding 
with p in at least a fraction Ftoi of the qubits). The projector 
PP^^ offers a more abstract interpretation and may be rigor- 
ously defined as 

Definition 5 (Acceptance projector) Given a pure N qubit 
product state p = pi cind a security parameter < 

Ftoi ^ 1> define the acceptance projector 



pp 

^ acc 



E 



N 



(g) {biPi + bipi) , 



i=l 



where b E {0,1} is a boolean string. 

By abused of notation, pi and its orthogonal complement 
:= I2 — Pi are used as rank 1 projectors in £(7^2). 



S.2.2. Soundness 

The soundness result states that even under imperfect stor- 
age and readout fidelity, legitimate qtickets work well as long 
as the fidelity loss is not too severe. The completely pos- 
itive trace preserving (CPTP) maps Mi will be assumed to 
represent the encoding, storage and readout of the z-th qubit 
component of the qticket. In this sense, the soundness state- 
ment takes place at the level of single qubits. This is neces- 
sarily the case, since legitimate qtickets are ruined if a sig- 
nificant fraction of the qubits fail in a correlated way. Given 



= F(M^), the average fidelity of the qubit map M^, we de- 
^^Fiio be the average qubit fidelity of the 
. Mi over all components. The probability 



fine Fexp := N' 
full map M = 
that the "noisy' 



qticket resulting from this map is accepted as 



valid is given by p^{M) = ^ EpeQ Tr [Pi,,M (p)]. 
Theorem 6 (Soundness of qtickets) As long as Fexp > i^t 



tol> 



an honest holder can successfully redeem qtickets with a prob- 
ability 



Ph 



(M) > 1 - e-^^(^^°ill^--p). 



Proof. Consider the boolean random variables X 
{Xi , . . . , Xjv) with joint distribution given by 



N 



M{p)l^{hiPi + hipi) 



i=l 



Since M = Mi, we may recast Eqn. S2 as 



(S2) 



^ 1 

Pr[X = = n R E [Mi{pi){hiPi + bipi)] (S3) 



i=l 



Since Q is a quantum state 2-design over qubit space, each 
factor coincides with the definition of the average fidelity Fi 
of Mi if hi = I and with 1 - if = 0. Hence the Xi 
are independent boolean random variables with probability 
Pr[Xf] = Fi. Moreover, according to definition 5, we have 



M{p)] = PrEti^i > ^toiA^]. Since 



\Q\ ^peQ -^^L^ acc^"^ KH)] ^ VA^i=l - 

the Xi are independent, a standard Chernoff-Hoeffding bound 
allows us to conclude. ■ 



S.2.3. Security 

The security statement expresses that for a sufficiently large 
security parameter Ftoi > 5/6, the average probability of a 
dishonest participant successfully forging two accepted qtick- 
ets from a single one is exponentially small in N. Indeed, 
when simultaneously submitting two qtickets produced by ap- 
plying the most general possible transformation T (a CPTP 
map) on a single valid qticket, the probability of both of them 
being accepted is exponentially small in as long as we are 
not given access to the classical description. 

Definition? (Counterfeiting fidelity) We define the average 
counterfeiting fidelity of a map T G T-Lq 

f <i(3^) = ^ E ^ Vn^f' T {p) (S4) 



The following is one of the main results and states that as 
long as the verification threshold Ftoi is set sufficiently high 
a counterfeiter will have negligible chances of producing two 
valid qtickets from a single genuine original. 
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Theorem 8 (Security ofqtickets) For Ftoi > 5/6 and for any 
CPTP map T eHq ^ we have that 



l||2/3) 



(S5) 



Most of the work for proving this goes into excluding the pos- 
sibiUty that a non-product counterfeiting strategy could per- 
form significantly better than any product strategy such as per- 
forming optimal cloning on each individual qubit. That is, we 
take into account the fact that the map T need not factorize 
with respect to the different components of the qticket. Note 
also that i:>(2Ftoi - l||2/3) = precisely for Ftoi = 5/6 
and is positive otherwise. Finally, we prove that even if the 
holder of a qticket attempts to perform v succesive verification 
attempts (each time possibly using information learned from 
the acceptance/rejection of previous attempts) the chances of 
having two or more submitted qtickets accepted grows by no 
more than a factor of (2) . 

Theorem 9 (Security ofqtickets with learning) If the holder 
of a valid qticket submits v tokens for verification, the proba- 
bility of having two or more accepted is upper bounded by 



Pd,v 



^ jg-iVD(2Ftoi-l||2/3)_ 



Note that since (2) is a polynomial of degree 2 in this bound 
still allows for an exponentially large number (in A^) of qticket 
submissions v, while preserving exponentially good security. 



1. Proof outline 

We now outline the proof for theorems 8 and 9. First, the 
claim in theorem 8 is equated to an equivalent one, which av- 
erages over the set of all pure product states instead of Q. We 
then bound the average cloning probability by (2/3)^ for the 
set of pure product states following the lines of R. F. Werner 
[S4] for the optimal cloning of pure states. From there, the 
generalized Chemoff bound from theorem 3 for dependent 
random variables allows us to derive the desired result. The 
result of theorem 9 is obtained from a counting argument re- 
lating the security of multiple verification attempts with the 
static counterfeiting fidelity bound of theorem 8. 



2. Equivalence with continuous statement 

For the qticket protocol, drawing each component from a 
discrete set of states is required in order to provide an efficient 
classical description. However, certain statements are sim- 
pler to analyze over the full set of pure product states. This 
is the case for the counterfeiting fidelity, which can also be 
expressed as a uniform average over all pure product states. 

Lemma 10 (Counterfeiting fidelity) The average counterfeit- 
ing fidelity of a map T can be expressed as 



Pd 



dp Tr 



(pLrTip) 



(S6) 



where J dp represents N nested integrations on the Haar 
measure of qubit components and p the resulting product 
state. 

Proof. Definition 5 may seem unnecessarily cumbersome, yet 
it serves to make explicit that the projector P^^^ is a polyno- 
mial of degree 1 in each of the components pi of the qticket 
p. Furthermore, note that regardless of what the multi-qubit 
map T is, its application T{p) has degree 1 in each of the 
components pi of p. Together this implies that the integrand 
of lemma 10 is an polynomial of degree at most 3 in each of 
the qubit components pi of p. We may conclude by observing 
that the average taken in definition 7 is equivalent to uniformly 
taking each component pi from a qubit state 3 -design. ■ 



3. Optimal cloning for pure product states 

R. F. Werner [S4] obtained a tight upper bound for the aver- 
age probability of a CPTP map T producing m clones from n 
copies of an unknown pure quantum state | ?/^). Our statement 
is that if one attempts to clone an N component pure prod- 
uct state, the optimal cloning probability is achieved by inde- 
pendently cloning each of the components; neither generating 
entanglement nor correlations may help with the cloning. We 
present this statement for the case of cloning two copies from 
a qubit product state, but the derivation is fully generalizable. 

Lemma 11 (Optimal cloning of pure product states) The av- 
erage cloning fidelity over N qubit component pure product 
states of a CPTP map T is bounded by 



dpTvif^'^np)] < (2/3) 



N 



Proof. One possible derivation of this lemma is by follow- 
ing the lines of the original proof for optimal cloning of pure 
states [S4]. First one shows that if there is a cloning map T 
achieving average fidelity then there is a covariant cloning 
achieving the same average fidelity. This map can be ex- 
plicitly constructed as 

T*{p) = jdg ^®^T{gpg^)r\ (S7) 

where the integral / dg averages over all possible local rota- 
tions g on N subsystems. This covariant map achieves ex- 
actly the same cloning fidelity for any initial pure product 
state since all pure product states are equivalent up to local 
unitaries. Finally, we observe 



Q<T,[(i^^T*{l2N -p)] 



(S8) 



since " 
then obtain 



p is positive and positivity preserving. We 



< Tr[y^2r^(l2iv)] 
and may now average this inequality over p and use 

(S2)®N 



I 



dp f>' = 



3iv 



(S9) 



(SIO) 
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where 5*2 is the rank 3 projector onto the symmetric space 
of two qubits. The operator norm of this expression is 1/3^ 
whereas Tr[T*(l2Ar)] < 2^ leading to < (|)^, as de- 
sired. ■ 



4. Pigeonhole argument and Chernojf bound 

We are now ready to prove the first no-counterfeiting result 
for qtickets. 

Proof of theorem 8. Consider the boolean random variables 
E = {El, . . . , En) with joint distribution given by 



dpTr 



N 



(Sll) 

Intuitively, the variable Ei represents the event of measuring 
the i-th component to be correctly cloned. 

In order for the two qtickets to be accepted, there must be 
a total of at least FtoiN components yielding the correct mea- 
sured outcome in each qticket. By the pigeonhole principle, 
this means that there are at least 2Fto\N — N components 
which were measured correctly on both submitted qtickets. 



Pd{T) < Pr 



N 



^^z>(2Ftoi-l)iV 



.i=l 



(S12) 



For arbitrarily chosen T, the Ei may be dependent variables. 
However, according to lemma 11, for any subset S of qubit 
components, we may bound 



Pr[\/iesEi] < 



\s\ 



(S13) 



Theorem 3, is now invoked to provide an upper bound on the 
RHS of eq. 12, yielding the thesis of theorem 8. ■ 



5. Combinatorial bound on learning 

The bound on counterfeiting that we have provided assumes 
that two (possibly entangled) counterfeits are produced by ap- 
plying a CP map on a single original copy. In contrast, a 
sequential strategy temporally orders the submitted qtickets 
where the production strategy (CP map) for the later submis- 
sions can depend on whether previous submissions where ac- 
cepted or not. The counterfeiter may learn valuable informa- 
tion about how to construct valid qtickets from the feedback 
provided by the verifiers. The content of theorem 9 is that 
even with a valid qticket and the information learned from v 
repeated submissions it is very unlikely for a counterfeiter to 
produce more than one accepted qticket. 
Proof of theorem 9. According to theorem 8, the proba- 
bility Pd{T) for any CP map T to produce two valid coun- 
terfeit copies from a single one, is upper bounded by B = 
g-iVD(2Ftoi-i||2/3) bound the counterfeiting probability 
of an interactive strategy S submitting v tokens for verifica- 
tion by the sum of the counterfeiting fidelity of (2) CP maps 



Tk^i. Each of these maps corresponds to the case in which a 
specific pair (/c, /) of the v submitted tokens are the first to be 
accepted by the verifiers. 

Without loss of generality, we assume that in an interactive 
strategy the holder waits for the outcome of the j-th verifica- 
tion in order to decide how to continue and produce the j+l-th 
subnussion. We model a v step interactive strategy 5 as a col- 
lection of CPTP maps {S^} with b a boolean string of length 
between and v — 1 representing what the counterfeiter does 
after receiving the first len(b) verification outcomes. 

Each is a CPTP map from to Uq^Uh, where Uq 
is a Hilbert space accommodating qtickets and Hh is a larger 
space representing the memory of the holder. 

For any partial verification result b we may write the CPTP 
map which produces the len(6) subnussions as S^^^^y which 
is composed of successively applying Sg for all initial sub- 
strings b' of b. That is 



5^0 :=S'0 



(S14) 





%^ ^ 



Figure SI: a) We schematically illustrate how a dynamical strategy 
S works. Each step of a strategy (grey rectangles) is a CPTP map 
which depends on the classical outcome h of previous verifica- 
tions. The first map 6*0 takes an original qticket p as input, whereas 
subsequent steps rely on an internal memory state of the holder. The 
content of internal memory could range from no information at all, to 
a full original qticket and a detailed register of previous submissions. 
The verifiers have a fixed strategy 11^ which consists of applying the 
measurement {Pace ^rej} ^^^Y returning the classical boolean 
measurement outcome, b) By fixing the classical input 6 to the strat- 



egy, a CPTP map G Uq 



)len(6) + l 



Hh is constructed, 



corresponding to one possible partial application of the strategy S. 
This CPTP map produces len(6) + 1 possibly entangled outputs in 
1-Lq from a single input qticket. 

For an interactive strategy S the probability that the first 
len(6) verification outcomes are given by bis expressed as 



bP^ 



)1 



len(6) 

peg j=i 

(S15) 

where P^- := 1q — Pfcc- The probability for the interactive 
strategy S to succeed at counterfeiting in v steps can be de- 
scribed as the sum of these probabilities over all possible full 
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verification outcomes including at least two acceptances 



Tensor cloning counterfeiting probability 



(S16) 



b:^bi>2 
len{b)—v 



The key idea now is to use Pj;{S) = P^q{S) + p^-^ (S) to pro- 
vide an alternate expression for this sum. Namely, we com- 
bine verification outcomes starting in the same way into a sin- 
gle summand while avoiding the inclusion of failed counter- 
feiting attempts. Each full verification outcome containing 
two or more successful verifications has a unique shortest ini- 
tial substring containing exactly two successful verifications. 
That a given substring is the shortest can be guaranteed by tak- 
ing the last verification of the substring to be one of the two 
accepted. 



Pd 



(S17) 



b:^b^=2 

^lenCb)^-*- 



Each of the (2) summands on the RHS of Eq. (S17), may be 
characterized by two indices /c, / s.t. 

k-l l-k-1 

6 = 0^^10^^1 for some </< V. (S18) 

For each one of these summands, we construct a static strategy 
Tk,i{p) = Tr\fe,/[5'^j^^^j(p)] which takes as input a single valid 
qticket p and submits exactly two tokens. The counterfeiting 
probability of this map on p is 




0.55 0.6 0.65 0.7 0.75 0.8 0.85 0.9 0.95 
Required acceptance fidelity 



Figure S2: We numerically calculate the probability of accepting 
two copies of a qticket when the adversary strategy is assumed to be 
independently cloning each of the N qubits using an optimal cloning 
map. We see that the probability of producing two accepted qtickets 
approaches a step function at 5/6 with N. 



Hoeffding's inequality. Even when failure of the two qtickets 
is anticorrelated, the probability of either of them failing veri- 
fication can not excede the sum. This shows that a the scheme 
can not be made secure for Ftoi < 5/6. While such a scheme 
provides optimal forging probability when (Ffoi = 1), other 
schemes could in principle outperform it in terms of counter- 
feiting capability. Althought this is in principle possible, our 
security result shows that assymptotically in TV, no other strat- 
egy may work for Ftoi > 5/6. 



Tr 
:Tr 



(^fcc)^'Tr\,,a^ti(5)(p)] 



len(6) 

= Tr[^,i(,^)(p) (g) 

len(6) 

>Tr[5,,(g)(p) (g) 



(S19) 



By averaging over p G Q we obtain p^(S') < P(i{Tk^i) < B 
and invoking Eq. (S17) we obtain 5') < (2)^- ■ 



S.2.4. Tightness 



S.2.5. Extension: Issuing multiple identical qtickets 



Our results admit generalization to a scenario where the c 
identical copies of each qtickets are issued and succesful ver- 
ification of c + 1 is to be excluded. To obtain an analog of 
lemma 10 requires the individual qubits composing a qticket 
to be drawn at random from a state t-design with t = c+(c+l) 
(for example t = 5 would already be needed if two identical 
copies are issued). The optimal c ^ c + 1 cloning probabil- 
ity for N component product states is in this case bounded by 

/ X AT 

( ) • The threshold fidelity required to guarante security 

is then given by Ftoi > 1 - ^c+i){c+2) ^^^^ ^toi, the 
analogous result to theorem 8 one obtained is 



For Ftoi < 5/6 applying an optimal qubit cloning map[5'4] 
A(p) = |p(g)p+^p(g)l + |l(g)pon each of the in- 
dividual qubits of the qticket provides a good counterfeiting 
probability. The plot in Fig. S2 illustrates the probability of 
counterfeiter to actually get two qtickets accepted when taking 
this approach. For each of the two counterfeited qtickets, the 
probability of failing verification is the cumulant of a binomial 
distribution B{N^ 5/6) up to F^oiN and rejection probability 
may be upper bounded by ^ exp(— 2A^(5/6 — i^toi)^) using 



Pc^c+i{T) < e-^^((-+i)^-'--llf$l). (S20) 

Finally, if v > c + 1 verification attempts are allowed, the 
probability of counterfeiting can be proven not to grow faster 
than (^^^) . The proofs of these claims completely follow the 
lines that have been presented. Striving for legibility, we have 
limited the proof presented to c = 1, thus avoiding the nota- 
tional burdon imposed by the extra indices required. 
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S.3. CV-QTICKETS 

In this section we provide a proof that cv-qtickets are se- 
cure, not only against counterfeiting but also against any other 
possible double usage. We first present definitions for cv- 
qtickets and their verification. We then state the associated 
soundness and security guarantees and outline the security 
proof. Only the proof of the security statement is provided, 
since proving soundness for cv-qtickets requires no additional 
techniques as compared to soundness of qtickets. 

S.3.1. Definition of cv-qticket 

Each cv-qticket is composed of n x r qubit pairs. Each 
qubit pair is prepared by choosing a state from 

{|0, +), |0, -), |1, +), |1, -), |+, 0), I-, 0), I+, 1), I-, 1)} 

uniformly at random. 

A full verification question for the cv-qticket will consist of 
n randomly chosen axes from {X, Z} each corresponding to 
a specific block of r qubit pairs. In principle, the holder of the 
cv-qticket then measures the polarization of every qubit com- 
ponents along the corresponding requested axis and commu- 
nicates the measurement outcomes to the verifier. The criteria 
to consider an answer correct is the following; within each of 
the n blocks, at least Ftoir of the reported outcomes corre- 
sponding to qubits prepared in a polarization eigenstate of the 
inquired axis should be given correctly. 

S.3.2. Soundness 

The soundness result states that even under imperfect stor- 
age and readout fidelity, legitimate cv-qtickets work well as 
long as the fidelity loss is not too severe. Again, the com- 
pletely positive trace preserving (CPTP) maps Mj will be as- 
sumed to represent the encoding, storage and readout of the 
j-th qubit component of the cv-qticket, with the full map over 
all components given by M = (2)je{i 2rxn} • 
case of cv-qtickets, sufficiently many (Ftoir) correct answers 
should be provided within each block, demanding that a suffi- 
ciently good average fidelity be implemented for every single 
block. A random remapping of the Cartesian axes for each 
qubit component of a cv-qticket is also necessary, and can 
be achieved via a random unitary (possibly from a unitary 2- 
design). This is required for example in the case where an 
actual physical polarization, say X, is lost faster than other 
components. In this case asking for the stored X polarization 
for all qubits in a block may yield a large failure probability 
even though the average storage fidelity among the qubits is 
sufficiently high. A random unitary remapping solves this and 
allows to connect with the average qubit storage fidelity, even 
in the case where only two nominal axes are used. 

Given Fj = F{Mj), the average fidelity of the qubit map 
Mj, we define Fexp,6 := N~'^ Z]j [X]=6^i to be the av- 
erage qubit fidelity within block b G {1, . . . , n}. Further- 



more, to simplify the final expression, let us define Fexp = 
min^Fexp,6. 

Theorem 12 (Soundness of cv-qtickets) As long as Fgxp > 
Ftoi, an honest holder implementing a map M can success- 
fully redeems cv-qtickets with a probability 

Observe that one may reduce this statement to n independent 
statements within each block which are completely analogous 
to the soundness for qtickets theorem 6. 

S.3.3. Security 

A naive security statement expresses that the holder of a 
single cv-qticket is unable to produce two copies from it, each 
with the potential of passing a verification. Since the verifi- 
cation of cv-qtickets is achieved by sending a classical mes- 
sage to a verifier, the security statement for cv-qtickets goes 
beyond this; it states that even with simultaneous access to 
two randomly chosen verification questions, the holder of a 
cv-qticket is exponentially unlikely to provide satisfactory an- 
swers to both. We further extend our security claim, to an even 
more adverse scenario; the holder of a cv-qticket has simulta- 
neous access to v independent verification questions and may 
proceed to answer them in any chosen order. Moreover failing 
in verification attempts does not forbid the holder from further 
attempts which may possibly be performed relying on the in- 
formation accumulated from previous verification outcomes. 

Let be a mathematical object denoting the counterfeiting 
strategy taken by the holder of a valid cv-qticket. We will de- 
note by {S), the probability that strategy S leads to two or 
more successful verifications when engaging in v verification 
attempts with possibly independent verifiers. The probability 
is taken over the random generation of cv-qtickets, of verifi- 
cation questions, and of measurement outcomes (Born's rule). 
The security statement is then 

Theorem 13 (Security of cv-qtickets) For any counterfeiting 
strategy S and tolerance parameter Ftoi > ^^Y^ ^^^^ 

pS;(^)<(;)'(l/2 + e--(--ll^))". 

The proof of this statement goes as follows. Since ab- 
stractly cv-qtickets consist of a set of randomly produced 
states and questions requested on these states the formalism 
of quantum retrieval games (QRGs) provides adequate mod- 
eling. This framework is presented in a largely self-contained 
manner, since its generality and potential make it of indepen- 
dent interest. We first provide basic definitions for QRGs 
and derive some simple results. Then we present possible 
ways of composing QRGs together with associated quantita- 
tive bounds. The first results are then applied to the qubit pair 
constituents of cv-qtickets to bound the holders potential to 
provide answers to complementary question. Cv-qtickets are 
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then modeled by a QRG for scenarios in which the holder of 
a cv-qticket wishes to simultaneously answer questions from 
two independent verifiers without any additional aid. Finally, 
a combinatorial bound, similar to the one used for qtickets, is 
used to provide an upper limit on how the double verification 
probability may increase with the number v of verification at- 
tempts. 



S.3.4. Quantum retrieval games 

Quantum retrieval games (QRGs), recently defined by 
Gavinsky [S5] provide a framework to analyze protocols in 
which information is to be extracted from a state produced ac- 
cording to a classical probability distribution. We will here 
present a definition of QRGs following Gavinsky as well as 
some additional results derived which may be of independent 
interest. 

Alice prepares a normalized state ps = q{s)/ps accord- 
ing to the probability Ps := Tr[^5] and transfers it to Bob. 
Whereas Alice remembers the index s of the generated state, 
Bob is only provided with ps and a full description of the dis- 
tribution from which it was generated. Alice then asks Bob a 
question about s which Bob attempts to answer as best as pos- 
sible. A simple possibility is for Alice to directly ask Bob the 
value of 5. In general however, the set of possible answers A 
need not coincide with the set of indexes S over the possible 
prepared states. If each answer a is either correct or incorrect 
the question may be modeled as a G S x A {0,1}. This 
is, cr( 5, a) = 1 iff the answer a is correct for state index s 
and cr(5, a) = otherwise. This definition faithfully repre- 
sents Gavinsky 's QRGs. We extend this notion to weighted 
quantum retrieval games (WQRGs) to model situations where 
some answers are "more correct" than others. Here for each 
prepared state s and possible answer a the game will assign a 
non-negative real value cr(s, a) associated to the utility func- 
tion of answer a given input s (i.e. a e S x A ^ 11+ )• 

Bob needs to choose an answer a e A and may use his copy 
of state Ps to do so. The most general strategy that Bob can 
take according to the laws of quantum mechanics is to per- 
form a positive operator valued measurement (POVM). We 
will consider post-selected POVMs, as opposed to a physi- 
cal POVM, as those which may fail to produce a measure- 
ment outcome. This is, whereas a physical POVM always 
produces an outcome from the expected set, for post-selected 
POVM some "invalid" outcomes are discarded and excluded 
from statistics. 

In order to express the random preparation of states by Al- 
ice we first define the notion of an indexed ensemble. 

Definition 14 (Indexed ensemble) We will say that g is an 
ensemble on % indexed over Siff^s G S : g{s) is a posi- 
tive operator on T-L and J^^^^ Tr[^(s)] = 1. 

Note that if g is an indexed ensemble, then p = g{s) is 
a normalized density matrix. Although Alice gives a spe- 
cific state g{s) / TY[g{s)] to Bob, since Bob does not know 
5, he does not know which one has been received. The state 
p = Tt Alice i^ses ^^q{^)] will be called the reduced density 



matrix of g since it corresponds to tracing out Alice's classi- 
cally correlated subsystem containing the index s. Without 
loss of generality, p can be assumed to be full rank on 1-L. 

In other words, a physical/selective projection V indexed 
over A is simply a physical/post-selected POVM equipped 
with an interpretation for each possible measurement outcome 
in terms of possible answers in a G A. 

Definition 15 (Selective and physical projections) We will 
say that V is a selective projection indexed over A ijf\/a G A, 
V{a) are bounded positive semidefinite operators on %. It 
will also be a physical projection ijf^^ = 1- 

Note that no normalization has been imposed for selective 
projections since induced probability distributions are normal- 
ized a posteriori. An indexed ensemble and a projection on the 
same Hilbert space induce a joint probability distribution over 
the indexes S x Aof prepared states and provided answers. 

Definition 16 (Induced probability distribution) Let g be 

an ensemble on T-L indexed over S and let V be a projection 
on % indexed over A. Then 



p{so:ao) 



TT[V{ao)g{so)] 
E.,aTr[P(a)^(.)]- 



(S21) 



is a probability distribution over S x A which will be denoted 
by p = {g^ V) and is undefined unless J2s a "^^[^ i^) > 
0. 

Furthermore, note that for physical projections the denomina- 
tor in Eq. (S21) is 1 and the marginal of the resulting dis- 
tribution over S is p{s) = J2aPi^^^) ~ ^^^iQi^)] which is 
independent of V. 

Definition 17 (Weighted quantum retrieval games) Let g 

be an ensemble on 1-L indexed over S. Consider a utility 
function a ^ S x A ^ R+. Then the pair Q = a) is a 
weighted quantum retrieval game. A WQRG is also a QRG 
when a x A^ {0,1}- 

The value of a game Q w.r.t. a projection V is the average 
utility obtained by Bob by using a certain measurement strat- 
egy V. This value is given by the expectancy of the utility 
function cr over the joint distribution of prepared states and 
measurement outcomes. 

Definition 18 The value of game Q = (g^a) w.r.t. projection 
V is defined as 

Val(^;, V) := Y^p{s, a)(j{s, a) (S22) 

where p = {g,V) is the induced probability distribution. 

We now define the optimum value achievable by Bob for two 
distinct conditions depending on whether selective or physical 
projections are allowed. 

Definition 19 The selective (respectively physical) value of a 
game Q are defined as 

Sel(^):= sup Val(^,P) (S23) 

V ^Selective projections 
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Phys(g) := sup \al{g,V). (S24) 

V ^Physical projections 

Note that according to this definition Sel(^) > Phys(^) since 
the supremum is taken over a larger set. However, for certain 
tailored games, the selective and physical values will coincide. 
The advantage of selective values is that they may be straight- 
forwardly computed and are more amenable to compositional 
results. If Bob is forced to provide an answer, he can only 
achieve the physical value of a game. If Bob is allowed to 
abort the game after measuring his state ps and aborted games 
are not considered when calculating his expected utility then 
he will be able to achieve the selective value. 

The following result provides an explicit formula to calcu- 
late the selective value of a game. In this sense, it is a gener- 
alization of lemma 4.3 in [55]. 

Theorem 20 (Selective value of a game) Let Q = {g, a) 

be a WQRG with g{s) = p. Define 0{a) := 
^^a{s,a)p~^^'^ g{s)p~^^'^. Then the selective value of Q 
may be calculated as Sel(^) = max^ ||0(a)||, where \\ • \\ 
denotes the operator norm. 

Proof. We first use the definition of the value of a game Q 
w.r.t. V, expand the induced probability distribution and move 
the sum over s inside the trace 



Val(^,P) 



(S25) 



We define V such that V{a) = p^/^V{a)p^'\ Using this 
definition and that of p and Oa we may rewrite 



Val(67,P) = 



EaTr[^(a)0(a)] 
EaTr[^(a)] 
TT[V{a)0{a) 



< max 



(S26) 



Tr[P(a)] 
< max||0(a)||. 



The first inequality uses the positivity of all summands. For 
the second inequality we note that V{a) must be positive 
semidefinite and the variational definition of operator norm 
of the positive semidefinite operator 0{a). Equality can be 
achieved by taking V{ao) to be a projector onto the highest 
eigenvalue subspace of O(ao) if ||0(ao)|| = max^ ||0(a)|| 
and taking p(ao) = otherwise. ■ 

The theorem provides an explicit construction of a projec- 
tion achieving the selective value of a game. Furthermore, the 
proof allows us to derive a necessary and sufficient condition 
under which the selective and physical values of a game coin- 
cide. 

Corollary 21 Given a retrieval game Q, we have that 
Sel(5) = Phys(5) iff there exist positive V{a) such that 

0{a)P{a) = Sel{g)P{a) and ^P(a) = p (S27) 



We now turn to the systematic composition of retrieval 
games in the form of product and threshold games. This pro- 
vides a way to construct more elaborate retrieval games to- 
gether with bounds on their associated values. A natural defi- 
nition of tensor product may be given for indexed ensembles, 
projections and utility functions. 

(^1 (8) ^2)(si, 52) = gi{si) (g) ^2(^2) (S28) 
{Vi^V2){aua2) = Pi (ai) 0^2(^2) (S29) 

(CTI (8)Cr2)((5i,52),(ai,a2)) = CTi (si , tti )cr2 (^2 , a2) (S30) 

These definitions have the property that the tensor product of 
physical projections is a physical projection and that the in- 
duced probability distribution of two tensor product is the ten- 
sor product of the individual induced probability distributions 

Definition 22 (Tensor product WQRG) Let Gi = {gi.ai) 

and Q2 = (^2, (^2)- define the tensor product WQRG Qi 
Q2 (^s 

Ql®Q2 = {Q1 ^ Q2, CTi (g) (72). 

Proposition 23 (Tensor product selective value) The selec- 
tive value of a tensor product game is the product of the selec- 
tive value of the independent games. 

Sel(ai^a2) = Sel(ai) 861(^2) 

Proof. By using the definition of 0{a) in theorem 20 with 
respect to the WQRG involved we obtain 

||0(ai,a2)|| = ||Oi(ai)0O2(a2)|| = ||Oi(ai)||||02(a2)||. 

Maximizing over ai and a2 on both sides theorem 20 provides 
the desired equality. ■ 

The selective value of the product game is attained by the 
tensor product of projections, each achieving the respective 
selective values. 

Corollary 24 (Tensor product physical value) If 

Phys(6;i) = Sel(6;i) and Phys(6;2) = Sel(6;2) then 
Phys(67i 672) = Sel(67i 672). 

Given a direct product game and a projection for it one may 
consider the inverse procedure of defining a projection on one 
of the subcomponents of the game. 

Definition 25 (Restriction of a projection) Let V be a pro- 
jection on T-Li (S) T-L2 indexed over Ai x A2. Furthermore, 
let p2 be a normalized density matrix on H2. We define the 
restriction V\ 1 with respect to p2 and A2 as 

V\i{ai) = Y^ Tr2 (P (ai , a2 ) 1 P2 ) . 



By abuse of notation, if p = p2 is a normalized product 
state in Hi ^ I-L2 we may define the restriction of V with 
respect to the normalized tensor factors of p. This is the case 
for the reduced density matrix of product indexed ensembles. 
By restricting a projection one obtains a new projection which 
induces the same reduced probability distribution 
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Lemma 26 (Restriction of a projection) Let V\i be the re- 
striction of V with respect to p2 and A2, where p2 is the re- 
duced density matrix of Q2. Then 

= ^(^10 Q2,V){siS2,aia2). 

Theorem 27 (Selective value of threshold QRG) Let Gj = 

{Qj.cFj) be WQRGs s.t. aj G 
SeliGj) = 6j for all j G {1,.. 



) [0, 1] and 
Furthermore take 

S = j=i ^^7^1- Define the QRG 

= Qj)^a^) with a tensor product ensemble distri- 
bution and boolean utility function 



. ,n}. 
< 1. 



cr^(5, a) 



Then we have Sel(^^) < 2e 



-nD(7||5) 



Proof. The direct product indexed ensemble g = 0^ qj and 
projection V induce a normalized probability distribution over 
S X A given by 



p{s, a) = 



TT[P{a)g{s)] 



Define the dependent random variable Xj to be aj{sj,aj) 
where Sj and aj are taken according to this probability dis- 
tribution. For any S C {l,...,n},we may define V\s as the 
restriction of the projection V to the subsystems specified by 
S with respect to (pg). By proposition 23 we have that 



The quantum retrieval game formalism applies to this prob- 
lem although one must admit that it is like cracking a nut with 
a sledgehammer. We call this game Gz = (q^o-z) where we 
have J2s Qi^) =P = ^4/4, and Tr(^(5)) = 1/8 for all s e S. 
A formal definition of the utility function az can be given as 
azis^a) = {si = ai or S2 = ^2). We first define the opera- 
tors 0(a) from theorem 20. Due to symmetry we may restrict 
to considering one such operator 

0(00) = 4 (^(0, +) + ^(0, -) + ^(+, 0) + ^(-, 0)) (S33) 

and find that ||O(00)|| = 1 which is a non degenerate eigen- 
value for all 0(a). The fact that the four corresponding 
eigenspaces are orthogonal confirms that 1 is also the phys- 
ical value of the game. 

The same trivial value of 1 can be achieved for the game in 
which Alice requests the X direction polarization of the states. 
We will call this game Qx = {q^(^x)- The problem becomes 
interesting if Bob is requested provide a guess for both com- 
plementary polarizations. There are two relevant possibilities, 
both of which will require Bob to give an answer twice as 
long as before. The first scenario describes the best case prob- 
ability of Bob answering both questions correctly and may be 
modeled by a QRG with utility function 

Ga = {q, cta) (^a{s, axaz) = (Tx{s, ax) A cr^(s, az). 

In the second scenario we are interested in the average num- 
ber of questions answered correctly when two complementary 
questions are posed and may be modeled by the WQRG with 
utility function 



Exp 



Gavg = {Qj CTavg) Cravg(s, axaz) 



(Tx{s,ax) ^crz{s,az) 



Using theorem 3 and definition 18 we obtain 



Val(6?^,P) = Pr 



Thanks to symmetries one need only calculate a single 
||0(a)|| and for concreteness we choose 0(+ + 00). For the 
conjunction QRG we obtain 



<2e -^^^11^). (S32) o(+ + 00)=4(^(0,+) + ^(+,0)) and||0++oo||=3/4. 



Since this is true for arbitrary V we conclude that Sel(^^) < 

2g-nD(7||5)^ , 



S.3.5. cv-qticket qubit pair building block 

Consider a game in which Alice transfers to Bob one of the 
following states chosen at random 

S = {|0, +), |0, -), |1, +), |1, -), I+, 0), I-, 0), I+, 1), I-, 1)}, 

each with probability 1/8. Alice then asks Bob for the Z 
polarization of both qubits, possible answers being A = 
{00, 01, 10, 11}. An answer is correct iff it coincides in the 
polarization of the qubit prepared in a Z eigenstate. Bob 
can always answer the question correctly by measuring both 
qubits in the Z basis. 



For the average WQRG we obtain 

0(+ + 00) =2[2^(0, +) + 2^(+, 0) + ^(0, -) 
+ ^(-,0) + ^(+,l) + ^(l,+)] 



(S34) 



and IIO++00II = 1/2 + l/VS ^ 0.8536. This is precisely 
the optimal fidelity for co variant qubit cloning (i.e. cloning 
of equatorial qubits). On the other hand, if Bob is asked the 
same question twice instead of complementary questions it is 
clear that he will be able to repeat two correct answers. All in 
all, if Bob is asked complementary question half of the time 
and coinciding questions half of the time he will be able to 
emulate an average fidelity of 3/4 + ^/2/S ^ 0.927. 

Indeed, once we have defined a concrete WQRG, calculat- 
ing its selective value becomes an exercise thanks to theorem 
20. Furthermore, if the game has sufficient symmetry it will 
be possible to prove a coinciding physical values for the game. 
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s.3.6. cv-qticket 

We will first bound the probability of answering two of 
these randomly chosen questions by bounding the selective 
value of the corresponding retrieval game. To do this, we 
bound the value of a game where r complementary questions 
are asked on r qubit pairs (this is precisely the case for one 
block when the two random questions are complementary). 



tol^ 



(S35) 

We will not calculate the selective value exactly but give 
a bound in terms of theorem 27. In order for the two block 
answers to be correct, among the two, at least 2Ftoir answers 
should have been provided correctly for individual qubit pairs. 
This is a weaker condition since it only imposes that the sum 
among the two block answers be sufficiently large, not neces- 
sarily implying that they are both above threshold. 



(S36) 

The description on the right hand side has precisely the form 
required for theorem 27. We conclude that the selective value 
and hence the probability within any strategy of providing 
valid answers to two complementary questions for the same 
block is upper bounded by 2 exp[-ri:)(Ftoi||l/2 + l/VS)] 
(forFtoi > 1/2 + 1/V8). 

Given two randomly chosen questions for a block there is 
a probability of 1 /2 that they will coincide and a probabil- 
ity 1/2 that they will be complementary. Taking this into 
account, the probability for a dishonest holder to correctly 
answer two such randomly chosen block questions is upper 
bounded by 1/2 + exp[-ri:>(Ftoi||l/2 + l/\/8)]. By tak- 
ing r sufficiently large, this value can be guaranteed to be 
smaller then 1 . Hence, the probability of correctly answering 
n such randomly chosen threshold question pairs will be up- 
per bounded by B := (l/2 + exp[-ri:>(Ftoi,l/2 + l/v^)])^ 
which can be made exponentially close to 1 in n. 



S.3.7. Combinatorial bound on choosing and learning 



Firstly, by simultaneously engaging in several (v) verifica- 
tion protocols with different verifiers, the holder may simul- 
taneously have access to v challenge questions. The holder 
may then for instance, choose the most similar questions and 
attempt to answer these. Furthermore, by successively par- 
ticipating in V verification protocols the holder can choose to 
perform verifications sequentially and wait for the outcome 
of the A:-th before choosing which question to answer as the 
/c + 1-th and providing an answer for it. 

In general, if the holder engages in v verification attempts, 
he will receive v random questions providing no additional in- 
formation on the cv-qticket. There are (2) possible question 
pairs among these, each of which can be seen as randomly 
chosen. Thus if no feedback is used the probability of an- 
swering at least one of these pairs correctly is upper bounded 
by (2)^- An example scenario where this bound is relatively 
tight is when r is very large and n is relatively small. In this 
case, the probability of answering two randomly chosen ques- 
tions is well approximated by the collision probability 2~^ ( 
i.e. the probability that two questions coincide ) which grows 
precisely as (2) if the holder has access to v independently 
drawn questions and may choose to answer any pair. 

Suppose now, that the answers to the verifiers are provided 
sequentially, so that the decision of which answer to produce 
for each verifier may be made dependent on the outcome of 
previous verifications. We can safely assume that the answers 
to challenge questions are then provided sequentially, each af- 
ter receiving the acceptance or rejection of the previous ones. 
We can then apply a similar argument to the one exposed for 
the proof of qticket security in section S.2 S.2.3 5. This yields 
an additional factor of (2) corresponding to the possible feed- 
back scenarios up to the point of the second accepted answer, 
each of which can be simulated statically (i.e. by assuming the 
given feedback and fixing a corresponding POVM to generate 
answer up to that point). Hence the total probability for an 
interactive strategy with v verification attempts of producing 
two or more accepted answers is upper bounded by (2) 

It may seem artificial for verifiers to select a random ques- 
tion each time. Randomness is important in order to avoid 
revealing information about the issued cv-qticket. However, 
the verifier may choose a random question once and for all 
and ask it until it is answered correctly. Once it has been an- 
swered correctly, the verifier knows that the cv-qticket has al- 
ready been redeemed and can thus reject all subsequent verifi- 
cation attempts. This is similar to the kind of scheme used for 
prepaid telephone cards discussed in the applications section. 
However, the quantum case provides an advantage since one 
may have multiple verifiers which do not communicate. In a 
simple example with two verifiers, two composite questions 
may be chosen such that they are complementary on every 
qubit pair (i.e. one question is chosen at random and uniquely 
determines the other). 



The formulation presented adequately models a scenario in 
which the holder of a cv-qticket does not receive any feedback 
from the verifiers. However, if the holder of a cv-qticket can 
engage in several verification protocols, new possibilities arise 
which should be taken into account. 



S.4. APPLICATIONS 

Our quantum information application attempts to reduce 
quantum requirements to a minimum. However, even prepare 
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and measure qubit memories remain technologically challeng- 
ing. For problems admitting a classical solution, such an ap- 
proach is likely to be technologicaly less demanding. In other 
words, relevant applications for prepare and measure quantum 
memories will be those solving problems for which no clas- 
sical solutions are known. In this section we discuss some 
problems with classical solutions and propose refinement of 
such problems for which no classical solution is possible. 

S.4.1. Enforcing single usage with a single verifier 

For some applications, the no cloning of quantum informa- 
tion is only an apparent advantage. Our qticket and cv-qticket 
constructions can guarantee an exponentially small double us- 
age probability. However, this is not an impresive feat for sce- 
narios where there is a single verifier or if the verifiers have 
acces to realtime communication with a centralized database. 
In this case, a randomly chosen classical ticket has equaly 
good properties. After a ticket is succesfully redeemed once, 
it can be removed from the central database, making it invalid 
for any succesive verification attempt. In fact this classical 
strategy is widely used for crediting prepaid phone lines with 
a client calling a toll free number and typing the purchased 
ticket number in order to credit a telephone account. Thus in 
such scenarios, the quantum strategy does not provide addi- 
tional protection with respect to a classical solution. 

S.4.2. Multiple non communicating verifiers 

In scenarios with multiple non communicating verifiers, 
(cv-)qtickets provide a soution to a problem where all classi- 
cal approaches fail. We describe a witness protection program 
as an example of how such a scenario might look like. 

In a witness protection program, a governmental institution 
decides to give asylum to a key eye witness to whom an un- 
forgeable quantum token is issued. This token can be used by 
the witness (holder) to claim asylum in any of a set of partic- 
ipating hotels (verifiers). The issuer also provides all hotels 
with the necessary information to verify the tokens. When 
using the token, neither the eye-witness nor the chosen ho- 
tel wish to divulge the locale where the witness is hosted, 
thus protecting both from being targets of an attack. This in- 
cludes suspending communication between participating ho- 
tels as well as with the issuing authority. Any classical so- 
lution can not prevent a sufficiently resourceful holder from 
making copies of the received token, thus hotels are forced to 
communicate in order to avoid its double use. In this case, 
a quantum solution based on unforgeable tokens is the sole 
possibility to satisfy these unique constraints. 



S.4.3. Reduced availability under sporadic verification 

In principle, a centralized database may guarante that clas- 
sical ticket are only redeemed once. However, there are situ- 
ations where the ticket should be available only to one holder 




Figure S3: 1) The issuing entity hands a qticket to the key witness. 
2) It provides the hotels with the secret classical description which 
will be used to verify it. 3a) An honest witness choses a hotel and 
physically transfer the qticket for verification. It will be accepted 
as long as the level of accumulated noise is below threshold. 3b) A 
dishonest witness will fail to counterfeit his/her qticker to provide 
acomodation for an additional guest. However, there is no way of 
avoiding a valid qticket from changing hands. 



at a time and the non-clonable nature of a qticket allows en- 
forcing this. One such example is the sporadic control of 
tickets required for a given service. For concreteness, imag- 
ine a qticket which is valid for making use of a public trans- 
portation network. Commuters are sporadically controled, at 
which point if they are found to have a invalid qticket they 
are charged an important fine, whereas if they are found to 
hold a valid qticket, they are provided with a fresh substitute. 
If the transportation tickets are classical, sporadic control can 
not avoid counterfeited copies in the hands of coluding com- 
muters from circulating simultaneously. The deceiving com- 
muters need only communicate classicaly among each other 
before and after they are controled, effectively sharing a single 
classical ticket to make use of the service multiple times [5" 7]. 
In contrast the unavailability of long distance quantum comu- 
nication would disallows them to share a qticket in such a way 
(i.e. each valid qticket may only be at one place at a time). 



S.4.4. The Quantum Credit Card 

Having developed a single verification, noise tolerant, non- 
forgeable token, such as the cv-qticket, it is now possible to 
examine generalizations to interesting composite protocols. 
For instance, Gavinsky's proposal [5'5] allows for multiple ver- 
ification rounds to be performed on a single token, while also 
ensuring that the token can not be split into two independently 
valid subparts. Such a construction may be seen as a quan- 
tum credit card. Indeed, the classical communication which 
takes place with the issuer (bank) to verify the cv-qticket (via 
"challenge" questions) may be intentionally publicized to a 
merchant who needs to be convinced of the card's validity. 
An alternate possibility is to follow the original interpretation 
as a quantum cash token where verification is performed by 
the receiver each time the "money" changes hands. 
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S.4.5. Excluding eavesdropers 

While qtickets do not provide additional advantage against 
dishonest holder in the scenario of a single verifier quantum- 
ness may provide an advantage against eavesdroping and un- 
trusted communication. In order to make online banking more 
secure, Banks routinely use TANs (transaction authentication 
numbers) as an additional security measure. The bank sends 
its client a list of TANs via postal service in addition to an 
online password which is set up via another channel. Each 
time a bank transaction is requested online by the client, the 
bank requests a TAN from the list to guarantee the authentic- 
ity of the transaction. An impostor then needs to know both 
a secret password used by the user and some TANs, thus in- 
creasing the difficulty to succesfully impersonate a transaction 
with respect to any single security measure. However, since 
TANs are classical objects it is conceivable that an eaves- 
droper may learn them while remaining undetected (imagine 
an eavesdroper taking xray pictures of the correspondence). 
This means that with some effort of the eavesdroper the addi- 
tional security measure becomes ineffective. 

This problem can be straightforwardly resolved by using 
quantum prepare and measure memories. Even if a cv-qticket 
is sent via an untrusted optical fiber or postal service, the re- 
ceiver may openly communicate with the issuer and sacrifice 
some of the received qubits in order to obtain a bound on how 
much information could have leaked to eavesdropers. This 
is precisely the approach taken in QKD to obtain a statistical 
bound on the information that has leaked out. Gavinsky's Q 
scheme, allowing multiple verification rounds may be reinter- 
preted as quantum TAN lists. The holder of a quantum TAN 
list may verify its validity, and perform a transaction by pub- 
licly communicating with the bank. If the quantum TAN list 
is verified to be legitimate, then the probability of an eaves- 
droper getting verified by using the leaked information will 
be negligible (exponentially small). In turn, the cv-qtickets 
described in the main text and appendix may be used as basic 
building blocks for such a scheme in the precense of noise. 



S.4.6. Combining with classical computational assumptions 

The qticket and cv-qticket protocols proposed require the 
verifiers to have acces to secret information (i.e. information 
which is sufficient to produce additional tokens). This poses 
a problem for situations where the verifiers can not be trusted 
with such sensitive information. Idealy, it should be possible 
to verify the tokens relying exclusively on publicly available 
information. Seeking to achieve this, Bennet et. al. [S6] made 
an ingenious proposal based on computational assumptions. 
We consider a family of such proposals and show that they 
are not secure. 

The proposal of Bennet et. al can be abstractly presented 
as follows. The mint secretly keeps the solution to a publicly 
known instance of a computationally hard problem. The prob- 
lem instance may have been generated by the mint from the 
solution in the first place. It is then possible for the mint to in- 
teractively convince anyone that it has the solution to the prob- 



lem without giving away any additional information about the 
solution. Such a method for convincing is known as a sta- 
tistical zero knowledge proof (SZKP). For many problems, 
SZKP can be set up in a cut and choose fashion. This is, 
the mint "cuts" the secret solution into two parts mi and m2 
which toghether allow reconstructing the secret solution but 
independently provide no usefuU information. 

We provide a simple example for this in the context of graph 
isomorphism. The mint generates two isomorphic graphs Gi 
and G2, publishes them but keeps the isomorphism secret. 
The mint can then proceed as follows to convince someone 
that it has a proof of Gi = G2. The mint generates a random 
graph Gc = Gi (which may be seen as the "cut") by random- 
ply permuting the vertices in Gi and offers to provide either 
the isomorphism proving Gc = Gi or the one for Gc = G2. A 
verifier then randomly "chooses" which of the two to request, 
a dishonest proover (lacking a proof of Gi = G2) would have 
no more than a 50% chance of being capable to answer cor- 
rectly. Thus by repeating this procedure n times, a verifier 
can be 1 — certain of the proof being conveyed. On the 
other hand, the verifier learns no information about the secret 
solution Gi = G2 which it could not have easily obtained 
independently. 

In our language, Bennet et al. go one step further and pro- 
pose that the mint hardcode such SZKPs into a token com- 
posed of a classical part and a quantum state. The holder of 
such a token would thus have access to a one time SZKP of the 
problem openly published by the mint. In order to do this, the 
"cut" is provided classicaly, whereas the two possible proofs 
are encoded in a quantum state such that either of them may be 
extracted by measuring the state but not both. As we will show 
however, this requirement can not be fuUfiled if one allows ar- 
bitrary coherent operations to be performed on the quantum 
tokens (i.e. security against the most general attacks is impos- 
sible). 

Suppose that we wish to encode two possible messages mi 
and 1712 into a large quantum state such that an adversary may 
learn either of them with a very high certainty but may not 
learn both of them. In order to show that this is not possible, 
we consider the simple scenario where two bits of information 
are encoded in a quantum state such that either of them can 
be retrieved by measurement with high presicion and show 
that it is possible (at least in theory) to retrieve both of them 
simultaneously with high succes rate. 

Consider a family of quantum states pa^/s used to multiplex 
the classical bits a, /3 G {0, 1}. That the holder of the quan- 
tum state can extract either a or (3 may be expressed by 

TviP^Pa'M > (1 - e)5c.,a' 
TrlP'pP.,,^,] > (1 - e)5p,0, 

where {P^} and {P^} are two projective measurements in- 
dexed over a and p respectively (i.e. Pg + Pf = Pq^ + P^ = 
1). We wish to show that by succesively performing both 
projective measurements both a and P may be obtained with 
relatively high certainty. Hence it is impossible to multiplex 
the a and /3 such that either may be recovered reliably but 
attempting to measure both remains highly unreliable. The 



13 



POVM corresponding to sequential measurement is given by 
Pa,i3 = Pa^^^a ^e wiU show that it is good to order ^/e 

= Tr[P>,,^] - Tt[P'^P^p^,^P^] - mP'^P^p^,^P^] + c.c) 
>1 - 26 - 2^TT[P^^PSPa,^PS] TT[p^,^Pg] 
>1 -2e-2Ve 

(S^ST" 



where we have used the Cauchy-Schwartz inequality to go ob- 
tain the second line simplifying further with P^ y {P^Y 

>- (Pg)^. Hence if we make e arbitrarily small, this will 
also make the probability of extracting both indices arbitrarily 
close to 1 . 
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